MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6537dc51442beed86b6cf785a5f3f5525aa9bebb25cadd3f38399797adf14259. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DiamondFox


Vendor detections: 10


Intelligence 10 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6537dc51442beed86b6cf785a5f3f5525aa9bebb25cadd3f38399797adf14259
SHA3-384 hash: b6d4eb06012f13089521fbff86f77f00729beb41fd5836c591733698fe5e990bc4cf44a99822ec84869b5e683cda593c
SHA1 hash: b54d4d19cd239b5ce601df691690419fe66e661e
MD5 hash: 669bb51bb539eaeb45c9163670d84c84
humanhash: massachusetts-mars-xray-fish
File name:669BB51BB539EAEB45C9163670D84C84.exe
Download: download sample
Signature DiamondFox
Create hunting rule
File size:4'050'276 bytes
First seen:2021-08-22 04:25:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 49152:9g+VxojDZfHdIX8A/DL/T+Uao5CcD67o31cDhBd8ADzUnrU2Yz0SihIwRHpmLEcZ:yKuhHoNao5CcD67o31KB2EoaUH/xa
Threatray 394 similar samples on MalwareBazaar
TLSH T1C11633496B816043F1600E327F7C76485DCB21B629FC46FE633FA3A61951F22C6646AF
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:DiamondFox exe


Avatar
abuse_ch
DiamondFox C2:
185.180.231.69:42875

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.180.231.69:42875 https://threatfox.abuse.ch/ioc/192572/
77.83.175.169:5180 https://threatfox.abuse.ch/ioc/192573/

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
669BB51BB539EAEB45C9163670D84C84.exe
Verdict:
No threats detected
Analysis date:
2021-08-22 04:26:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2b9f1a13-6a58-44ed-ae55-d25f8bbbd31d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181164/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Deleting a recently created file
Launching a process
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Bsymem
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5c696f16-356d-4197-8418-179ecfedce6e
Result
Threat name:
RedLine Socelars Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/836933
Signature
.NET source code contains very large strings
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates HTML files with .exe extension (expired dropper behavior)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file has a writeable .text section
Sets debug register (to hijack the execution of another thread)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Svchost Process
Submitted sample is a known malware sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected RedLine Stealer
Yara detected Socelars
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 469362 Sample: AzLV1RfxCi.exe Startdate: 22/08/2021 Architecture: WINDOWS Score: 100 115 34.97.69.225 GOOGLEUS United States 2->115 147 Antivirus detection for URL or domain 2->147 149 Antivirus detection for dropped file 2->149 151 Multi AV Scanner detection for dropped file 2->151 153 13 other signatures 2->153 13 AzLV1RfxCi.exe 10 2->13         started        16 rundll32.exe 2->16         started        signatures3 process4 file5 103 C:\Users\user\AppData\...\setup_installer.exe, PE32 13->103 dropped 18 setup_installer.exe 18 13->18         started        21 rundll32.exe 16->21         started        process6 file7 81 C:\Users\user\AppData\...\setup_install.exe, PE32 18->81 dropped 83 C:\Users\user\AppData\...\Wed15f94f82567f.exe, PE32 18->83 dropped 85 C:\Users\user\...\Wed1595f777e32404.exe, PE32 18->85 dropped 87 13 other files (4 malicious) 18->87 dropped 24 setup_install.exe 1 18->24         started        159 Writes to foreign memory regions 21->159 161 Allocates memory in foreign processes 21->161 163 Creates a thread in another existing process (thread injection) 21->163 28 svchost.exe 21->28 injected signatures8 process9 dnsIp10 131 172.67.142.91 CLOUDFLARENETUS United States 24->131 133 127.0.0.1 unknown unknown 24->133 135 192.168.2.1 unknown unknown 24->135 165 Adds a directory exclusion to Windows Defender 24->165 30 cmd.exe 24->30         started        32 cmd.exe 1 24->32         started        35 cmd.exe 1 24->35         started        37 8 other processes 24->37 167 Sets debug register (to hijack the execution of another thread) 28->167 169 Modifies the context of a thread in another process (thread injection) 28->169 signatures11 process12 signatures13 39 Wed15f94f82567f.exe 30->39         started        139 Submitted sample is a known malware sample 32->139 141 Obfuscated command line found 32->141 143 Uses ping.exe to sleep 32->143 145 2 other signatures 32->145 44 powershell.exe 24 32->44         started        46 Wed15251f7879.exe 35->46         started        48 Wed15156f2613c99fcf8.exe 1 14 37->48         started        50 Wed157806d79d1e.exe 37->50         started        52 Wed155a25e62a3deb4.exe 2 37->52         started        54 4 other processes 37->54 process14 dnsIp15 117 185.233.185.134 YURTEH-ASUA Russian Federation 39->117 119 37.0.10.214 WKD-ASIE Netherlands 39->119 125 11 other IPs or domains 39->125 89 C:\Users\...\xfi9KWLzzerpOknVAC5IHMfn.exe, PE32 39->89 dropped 91 C:\Users\...\xax0O5nKW_06qiS1A9mmlURi.exe, PE32 39->91 dropped 93 C:\Users\...\rffJo3mCGw_m7LwQklvfxZZP.exe, PE32 39->93 dropped 101 35 other files (32 malicious) 39->101 dropped 171 Drops PE files to the document folder of the user 39->171 173 Creates HTML files with .exe extension (expired dropper behavior) 39->173 175 Tries to harvest and steal browser information (history, passwords, etc) 39->175 177 Disable Windows Defender real time protection (registry) 39->177 179 Machine Learning detection for dropped file 46->179 181 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 46->181 183 Checks if the current machine is a virtual machine (disk enumeration) 46->183 56 explorer.exe 46->56 injected 121 208.95.112.1 TUT-ASUS United States 48->121 127 3 other IPs or domains 48->127 95 C:\Users\user\AppData\...\fastsystem.exe, PE32+ 48->95 dropped 97 C:\Users\user\AppData\...\aaa_011[1].dll, DOS 48->97 dropped 185 Drops PE files to the startup folder 48->185 58 cmd.exe 50->58         started        60 dllhost.exe 50->60         started        187 Creates processes via WMI 52->187 62 Wed155a25e62a3deb4.exe 52->62         started        123 88.99.66.31 HETZNER-ASDE Germany 54->123 129 2 other IPs or domains 54->129 99 C:\Users\user\AppData\Local\...\LzmwAqmV.exe, PE32 54->99 dropped 189 Detected unpacking (changes PE section rights) 54->189 66 LzmwAqmV.exe 54->66         started        file16 signatures17 process18 dnsIp19 68 cmd.exe 58->68         started        71 conhost.exe 58->71         started        137 172.67.222.125 CLOUDFLARENETUS United States 62->137 105 C:\Users\user\AppData\Local\Temp\sqlite.dll, PE32 62->105 dropped 73 conhost.exe 62->73         started        107 C:\Users\user\AppData\Local\Temp\3.exe, PE32 66->107 dropped 109 C:\Users\user\AppData\Local\Temp\2.exe, PE32 66->109 dropped 111 C:\Users\user\AppData\Local\...\Chrome 5.exe, PE32+ 66->111 dropped 113 2 other files (none is malicious) 66->113 dropped file20 process21 signatures22 155 Obfuscated command line found 68->155 157 Uses ping.exe to sleep 68->157 75 findstr.exe 68->75         started        77 Riconobbe.exe.com 68->77         started        79 PING.EXE 68->79         started        process23
Detection:
glupteba
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6537dc51442beed86b6cf785a5f3f5525aa9bebb25cadd3f38399797adf14259/
Threat name:
Win32.Trojan.Fabookie
Create hunting rule
Status:
Malicious
First seen:
2021-08-19 03:35:56 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mu35yukefpxnq23m66c2l47vkjnktpv3exfn2pzyhglzplprijmq._file
Verdict:
unknown
Similar samples:
0a823cbd6a32a10c927253fa40466c8a3177e487ee7895a8a2e244a9b4c415fc
DiamondFox
186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad
DiamondFox
450b8f11dfa06aee1def7d2b49c29d670406b765e9900efe7d1e8bb1ffff486f
DiamondFox
4571cb6a42768d962b83472fd0e0069e56df5e005f15c1479f046bdf65dece1a
DiamondFox
723e570331aa3284a7b94f247edd6c395df4dc0f55f1d263f418207c28ef0dbe
DiamondFox
bd175fda8c98a44237f8da7e02e48f6aaf00365bec2e7e38b7b42414bd888d95
DiamondFox
e1c8f91a01400615df83126a8b3a323425f30b5480d405b26adf2d924c21464f
DiamondFox
+ 384 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:vidar botnet:706 botnet:937 botnet:dibild botnet:pab3 aspackv2 backdoor infostealer persistence stealer suricata themida trojan
Link:
https://tria.ge/reports/210822-3wmcgxs74s/
Behaviour
Kills process with taskkill
Runs ping.exe
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Themida packer
ASPack v2.12-2.42
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
RedLine
RedLine Payload
SmokeLoader
Vidar
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
https://eduarroma.tumblr.com/
185.215.113.15:61506
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
135.148.139.222:33569
Unpacked files
SH256 hash:
a18e5d223da775448e2e111101fe1f4ab919be801fd435d3a278718aa5e6ccba
MD5 hash:
0c6cae115465a83f05d3ff391fd009ac
SHA1 hash:
066ea93bb540ae4be0d2e522d4bb59eec74053ad
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
Parent samples :
7755e890ecb6b60a9cbed072a609fbe099968b1fbda51f1d1f940bbc581c9f70
fc2e04d392ab5e508fdf6c90ce456bfd0af6def1f10a2074f82df8f58079d5e4
f29a3cecd0efa7f1f0c45c8572048c942090dcebdd968b9fcf4cce4380c01824
ddeebc8cccc58e25ce1709b0e9a519b2bd46472e928606bc4b0eee2553303203
22275b7c5a57111aca919f6bbfae171e5e99f5ef777d1043802deb672f5136a0
d1f610af3c46fff6c857be0136c696604eb8e7466b4a7e40f6b459cfa8339422
8f9cdf75c272fda7df367232756ea065600077804b16506ee5a4203571328217
0a7d966e66cbd260c909de1d79038c86a071f2f10a810f5890a150b67c4fd954
1b4c7144874551beb52bc3e864822c0b803d0967531addf9612f61898cf2394d
090f1369dc856e37b73969d22799341b1d328a235470ee608d3e32dd34df7022
4879803b6326f27bb8b68448fe7394b2358c2eeb25ec2c4c6a176313d003c29a
7227c5067dc82a381a3c7485a21c64b702f7e987a46d1349f95e269399e862eb
54bcd3308c140c8ec030f98697cc7f0e9d4585d54334a2eb77c58879510d5c8c
47e9b75457446a3b3c86622dd282065b0f88603e2c009670c1f7eaf00183a407
ada6977abf5caa24a75f0db17220267f6b05f11ed949757e8fc8beab3c720fc1
aa79b859945459fd6d1363c35e68c9d2674a78f1fdee02b8ddfab9a8fa011b48
0f3752cdf6653a331205269e6bd6ca4e265247847eed5be677bf758f29235d08
a412840c44db8bca039ce13176d7d6b9be9b2cbd1ef81eb85cd2f0c9180f6511
93ac84d519edb6350cf53736449330985fe1cb52eff043857daf6cca916d6fa3
a3f0b643265e9895b3291658516ce2b34eb06d585bd8ea77fd61fda26917e0d9
5c97c35e6537283493bbfcd8fa178157898e6d266a36eadb9ab23bbcef613efc
SH256 hash:
207056003b4b6e55dfe2557a2d1ca119c7785cfe626328a4a8c74323238933e9
MD5 hash:
4955a27a03f35933fdbd801f425b6c58
SHA1 hash:
97f3b8f33fd1a49cf9db5a246d996047beef3c12
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
Parent samples :
db50d646494970b78887d4d84f52147c4cdbaa0b23cb4eb330ffa2403735937c
f1e1b516a83f303659e53d513c9c3da9dfd466f40b96f8de86ca37ce9544d234
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
93ac84d519edb6350cf53736449330985fe1cb52eff043857daf6cca916d6fa3
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
269d2ae2661789f8929d934a7f7e44b6d6fa2e2fc3799fd53b44988aed906b1f
SH256 hash:
3e35832690fd1115024f918f4bc37e756b1617ae628e55b94f0e04045e57b49b
MD5 hash:
77c6eb4eb2a045c304ae95ef5bbaa2b2
SHA1 hash:
eeb4a9ab13957bfafd6e015f65c09ba65b3d699c
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
44d33d40c9362cd060b8696cf2848b6ec4b4d591738d12a07241820e88c1772e
MD5 hash:
ad2bdb5c9b71b3908ec920a3ebd33513
SHA1 hash:
c4e528056f461fff91c659dcc9e2c0e39468b60f
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
c22d73c0e9923ec307ff03639ea96a928b417987a42e1d263c12de6e7b41cffb
MD5 hash:
d28bdd8c0752afa50a10cd52d0525be1
SHA1 hash:
a8a856736b32721b700b9ee231751b54bf6a6dc6
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
598fec81466082f9c4fdcc70adc961f2fa7ae1eaa7faf9ed21092aa095034d74
MD5 hash:
ad492b41dd1a76ceb5a597ee74053495
SHA1 hash:
9abdaa776f5cbf8a72591104f492296ccded3187
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
762bfc4ac412480a909b440086f0e7ac77f087a2f9e103f19c6f37f413cc3a7e
MD5 hash:
633cb69dbc02bf10ce09073c85307595
SHA1 hash:
9a65551cc03917ec9fc82a4ca53841ac662938f0
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
1ab460eac81001bfa0da8cbadfd4fba0ad0f371742a2c725ff5cf71bdd8e2b9f
MD5 hash:
1dc95107f7dd6d1392bb8d9b53b76916
SHA1 hash:
b26f9c90ad4656d2ddf3e96da967e0f65a9623e1
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
d1ff2f8a510fb4d25dd861e4cd5196585ccdd66cd6e941941e13d634da825f32
MD5 hash:
e3ed5e6a62ece3cf158688bce4161fbf
SHA1 hash:
5a8c4dddf69e8650952b0d29987cc6edfe25fb0b
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
ab9bb888f6235eaee1ad52cd9b4d1f960ea09743ff80919d0095383f3683c583
MD5 hash:
eff546ee925781db419befdf93bd045d
SHA1 hash:
1129b509403fa589b50310f99f77c69ecc7f8314
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
092f7cdb24e1f159ff96f8722709f11763ed8a7b6d30030c3c8c061ff1a17076
MD5 hash:
34fdd72a0040886d7afd3e9207bf9f58
SHA1 hash:
2a833dfa6d27d18e61a45c4842132f36aef52e36
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
bca78b861ea1aee3d885a13375a6a8a6125af9ffbf9192b13e3f5eb8d6b3b3b7
MD5 hash:
199aa9a249159512da14f380a611450c
SHA1 hash:
a0a3610d70b4ed5d4e2be116009a24331ab1eb8e
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
d68c6b4d99ed5b0c7ecd70255ffc8d64a3299b5799a4d60ac74dfd17afad9b4b
MD5 hash:
c96695c280ed077d8c29e812184f28a8
SHA1 hash:
cea63a743c2c4d5e8ec7606f4bcd743ee7b40e4a
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
3433e0cf989a1f56c9507e74fe3a74c8edff3f825dace24e7c0e5d1811cfdd7a
MD5 hash:
d0edcd638e3f8df16d05dc8e109a1964
SHA1 hash:
1a449d72c7cb4ff0d9d0646b7af2829ee67fddfe
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
c6b18a80d2e2eed85c2afa6565c756c1ecf603cb683f347fa9ae05f3143e755d
MD5 hash:
6430a5bb453930c7c64e93b7ad104d0f
SHA1 hash:
ed555baa1a1f468f9f629fdaf502c61936ce1c0d
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
ae23ba47ba86ea073b79403a673e9a506004cacdaa1979ecc060d5e4837dd4d4
MD5 hash:
e9a41ead594d09cebfbd3e8dece0f5a5
SHA1 hash:
4a761ba039d5428c4074e87e0f4061080e64a1fe
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
SH256 hash:
6537dc51442beed86b6cf785a5f3f5525aa9bebb25cadd3f38399797adf14259
MD5 hash:
669bb51bb539eaeb45c9163670d84c84
SHA1 hash:
b54d4d19cd239b5ce601df691690419fe66e661e
Link:
https://www.unpac.me/results/b8e84356-f3e4-4a66-9f4b-44616e1ba53a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6537dc51442beed86b6cf785a5f3f5525aa9bebb25cadd3f38399797adf14259

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/181164/

Comments